Eye Security tadqiqotchilari tashlab ketilgan Popcorn Time fork'ining yangilash mexanizmini o'chirib qo'yishdi va uning domenlarini sinkhole qildilar.
BitTorrent mijozi foydalanuvchilarga vebdan yuklab olingan filmlarni ko'rish imkonini bergan, Popcorn Time o'n yildan ortiq avval juda mashhur edi, lekin loyiha 2014-yilda tashlab ketilgan. 2025-yil boshidan beri huquqiy muqobil ishlab chiqilmoqda.
Eye Security tomonidan nishonga olingan zaif yangilash mexanizmi Time4Popcorn'ga tegishli, bu asl nusxaning fork'i bo'lib, Popcorn Time nomi ostida tarqatilgan.
Eye Security tashlab ketilgan yangilovchi yangilanishlarni so'rash uchun HTTP orqali o'z masofaviy serverlariga ulanishini, va yangilash domenlarining ko'pchiligi tashlab ketilganini, boshqalari esa uchinchi tomonlarga tegishli va park qilinganini aniqladi.
Yangilovchi tizim yuklanishida fon rejimida ishlaydi, kod imzolash xususiyatiga ega emas va domen taqdim etgan har qanday bajariladigan faylni yuklab oladi va ishga tushiradi.
Tashlab ketilgan popcorntimeupd.xyz domenini ro'yxatdan o'tkazgandan so'ng, Eye Security millionlab tizimlar unga ulanishini kuzatdi. Tizimlar boshqa domenlarga ham ulanishdi va kompaniya ularning ba'zilarini ham ro'yxatdan o'tkazdi.
Aniqlangan tizimlarning aksariyati Windows (2,5-3 million) edi, qolganlari macOS (250 000-350 000) va Android (200 000 dan kam) da ishlardi.
"Ko'pchilik mijozlar butun dunyo bo'ylab oxirgi foydalanuvchi ISP'laridan ulanishmoqda, lekin biz turli hukumat va harbiy tarmoqlardan ham ulanishlarni ko'rmoqdamiz. Shuningdek, biz korporativ tarmoqlardan ko'plab mijozlar ulanishini ham ko'rmoqdamiz," deb xabar berdi Eye Security. "Bundan xulosa chiqarish qiyin, lekin biz jinoyatchilar bu tizimlarning ko'pchiligi bilan juda qiziqishini aytish xavfsiz deb o'ylaymiz."
Xavfsiz bo'lmagan yangilovchi ulanishi bu qurilmalarning barchasini potentsial trafik manipulyatsiyasiga duchor qildi, bunda hujumchi o'zining zararli yangilanishini taqdim etishi mumkin edi, bu esa System/root huquqlari bilan bajarilar edi. Zaiflik CVE-2026-30612 sifatida kuzatilmoqda.
Loyiha tashlab ketilganligi sababli, yangilanish orqali asosiy kamchilikni tuzatadigan sotuvchi yo'q edi va Eye Security ishni o'z qo'liga oldi: tadqiqotchilar uchinchi tomonga tegishli bo'lmagan 15 ta domenni ro'yxatdan o'tkazishdi va zaif mexanizmni butunlay o'chirish uchun yangilanishni tarqatishdi.
Eye Security operatsiyani 2025-yil noyabrda boshladi va 2026-yil mart oyiga kelib, taxminan 2 million tizimga tuzatishni yetkazdi, bu esa o'z domenlariga yangilanish so'rovlarining 98% kamayishiga olib keldi.
Biroq, yangilanishlar faqat Windows va macOS tizimlariga taqdim etildi. Android'da jarayon foydalanuvchi aralashuvini talab qiladi va yangilovchi ilovaning bir qismi bo'lib, mustaqil ravishda o'chirilishi mumkin emas.
Mart oyining oxirida The Shadowserver Foundation domenlarni o'z nazoratiga oldi va ular boshqa domenlar bilan birga sinkhole qilingan holda qolmoqda, Popcorn Time ilovasi ulardan JavaScript kodini yuklab olgan (va ular ham tashlab ketilgan).
Zaif yangilovchini qo'lda ham o'chirish mumkin. Biroq, ilova 2014-yilgi Chrome versiyasiga asoslangan, sandbox yo'q va butunlay o'chirilishi kerak.
"Bizning yangilanishimiz faqat yangilovchini o'chirdi. Ilovaning qolgan qismi o'zgarmagan, shuning uchun Popcorn Time'dan hali ham foydalanadigan har bir kishi uchun bu xavflar saqlanib qoladi. Biz allaqachon JavaScript orqali calc.exe'ni bajaradigan proof of concept yaratdik, shuning uchun xavf haqiqiy. Shuning uchun bizning maslahatimiz oddiy: uni o'chirib tashlang," deb ta'kidlaydi Eye Security.
Bog'liq: Dengiz Koalitsiyasi Kema va Port Tizimlari Uchun Bepul Zaiflik Ma'lumotlar Bazasini Ishga Tushirdi
Bog'liq: PHP2Shell Ekspluatatsiyasi Tekshiruvlardan Ishlaydigan Shell'larga O'tdi
Bog'liq: Hujumchilar To'rt Oy Ichida Uchinchi Arista VCO Zero-Day'ni Ekspluatatsiya Qilmoqda
Bog'liq: Atlassian Data Center va Server Mahsulotlarida 75 Ta Kamchilikni Tuzatdi
Eye Security researchers have disabled the update mechanism of an abandoned Popcorn Time fork and sinkholed its domains.
A BitTorrent client that allowed users to view movies downloaded from the web, Popcorn Time was highly popular over a decade ago, but the project was abandoned in 2014. A legal alternative has been in the works since early 2025.
The vulnerable update mechanism targeted by Eye Security belongs to Time4Popcorn, a fork of the original that has been distributed under the name Popcorn Time.
Eye Security discovered that the abandoned updater is connecting to its remote servers over HTTP to request updates, and that many of the update domains have been abandoned, while others are owned by third parties and parked.
The updater runs in the background at system boot, does not feature code signing, and downloads and runs any executable its domain supplies.
After registering the abandoned domain popcorntimeupd.xyz, Eye Security observed millions of systems connecting to it. Systems also connected to other domains, and the company registered some of those as well.
Most of the identified systems were Windows (2.5-3 million), with the remaining running macOS (250,000-350,000) and Android (less than 200,000).
“Most clients are connecting from end-user ISPs spread across the world, but we’re also seeing connections from various government and military networks around the world. We’re also seeing a lot of clients connecting from corporate networks,” Eye Security reported. “It’s hard to draw conclusions from this, but we think it’s safe to say criminals would be very interested in many of these systems.”
The insecure updater connection exposed all these devices to potential traffic manipulation, where an attacker could serve their own malicious update that would be executed with System/root privileges. The vulnerability is tracked as CVE-2026-30612.
Because the project had been abandoned, there was no vendor to patch the underlying flaw via an update, and Eye Security took matters into its own hands: the researchers registered 15 domains that were not owned by a third party and pushed an update to entirely disable the flawed mechanism.
Eye Security began the operation in November 2025 and, by March 2026, it had served the fix to roughly 2 million systems, which translated into a 98% reduction of update requests to its domains.
However, the updates were supplied only to Windows and macOS systems. On Android, the process requires user interaction, and the updater is part of the application and cannot be independently disabled.
In late March, The Shadowserver Foundation took over the domains, and they remain sinkholed along with other domains that the Popcorn Time application was loading JavaScript code from (and which were abandoned as well).
The vulnerable updater can also be disabled manually. However, the application is built on a 2014 version of Chrome with no sandbox and should be completely removed.
“Our update only disabled the updater. The rest of the application is unchanged, so these risks remain for anyone who still uses Popcorn Time. We already created a proof of concept that executes calc.exe via JavaScript, so the risk is real. That’s why our advice is simple: uninstall it,” Eye Security notes.
Related:Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Related:PHP2Shell Exploitation Moves From Probes to Working Shells
Related:Attackers Exploit Third Arista VCO Zero-Day in Four Months
Related:Atlassian Patches 75 Flaws in Data Center and Server Products